CVE-2025-15455CWE-287

CVE-2025-15455

Medium · published January 5, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-01-05T09:15Z
Affected products (1)
ProductVersionsFixed in
1234n/minicms≤ 1.8—
References (4)
https://github.com/ueh1013/VULN/issues/14 · [email protected]https://vuldb.com/?ctiid.339488 · [email protected]https://vuldb.com/?id.339488 · [email protected]https://vuldb.com/?submit.725137 · [email protected]
EPSS history
Timeline
  • 05 JAN 03:32Z
    bg5sbk MiniCMS File Recovery Request page.php delete_page improper authentication
    cvelistv5